Flippercode vulnerabilities
We track 8 vulnerabilities in Flippercode products across 6 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on September 25, 2026.
Latest Flippercode vulnerabilities
- 7.5 High severity
WP Maps – Google Maps, OpenStreetMap, Mapbox…: Improper Control of Filename for Include/Require Statement in PHP Program
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authe
- 9.8 Critical severity
WP Maps Pro: Missing Authentication for Critical Functionality
The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected
- 7.5 High severity
WP Maps – Store Locator,Google…: Improper Neutralization of Special Elements used in an SQL Command
The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 4.9.1 due to insufficient escaping on the
- 7.5 High severity
WP Maps – Store Locator,Google…: Improper Neutralization of Special Elements used in an SQL Command
The WP Maps plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'location_id' parameter in all versions up to, and including, 4.9.1. This is due to the plugin's database abstraction layer (`FlipperCode_Model_Base::is_column()`) treatin
- 8.8 High severity
WP Maps – Store Locator,Google…: Improper Limitation of a Pathname to a Restricted Directory
The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8.6 via the fc_load_template function. This makes it possible for authen
- 8.8 High severity
WP Maps – Store Locator,Google…: Improper Neutralization of Special Elements used in an SQL Command
The WordPress Plugin for Google Maps – WP MAPS plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'put_wpgm' shortcode in all versions up to, and including, 4.6.1 due to insufficient escaping on the user supplied parameter and la
- 8.8 High severity
WordPress Plugin for Google Maps – WP MAPS…: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in flippercode WordPress Plugin for Google Maps – WP MAPS (formerly WP Google Map Plugin) plugin <= 4.4.2 versions.
- 8.8 High severity
WP Google Map Plugin (WordPress plugin): Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3).